Web Applications that want to decrypt CardSpace tokens need read access to the SSL private key. But you would increase your attack surface tremendously if you directly grant this access to the worker process account of your application. The TokenDecryptionService allows decrypting tokens without having to have direct access to the private key in the application.